Super helpful, thanks for writing it. Same techniques are still effective on Django 2.2, and you’re right — it’s not exactly intuitive how to do this.

Contrary to the other commenter, I did this with an external app (Django Two-Factor Auth) that I installed via pip with no issues.